feat: ship protocol 3 and semantic browser elements

.changeset/README.md

@@ -12,4 +12,4 @@ Understudy versions published packages on `dev` and publishes them from `master`
 
 If another changeset reaches `dev` before promotion, merge the regenerated `Version Packages` pull request and update the promotion. The release workflow rejects pending changesets on `master`.
 
-Do not merge `master` back into `dev`. The apps in `apps/backend` and `apps/extension` are private and never publish. Read the [Changesets documentation](https://github.com/changesets/changesets) for CLI details.
+Do not merge `master` back into `dev`. The apps in `apps/backend` and `apps/extension` are private, versioned directly in their manifests, and excluded from Changesets versioning and publishing. Read the [Changesets documentation](https://github.com/changesets/changesets) for CLI details.

.changeset/config.json

@@ -6,6 +6,10 @@
   "linked": [],
   "access": "public",
   "baseBranch": "dev",
+  "privatePackages": {
+    "version": false,
+    "tag": false
+  },
   "updateInternalDependencies": "patch",
   "ignore": [],
   "___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH": {

.changeset/protocol-three-hard-cut.md

@@ -0,0 +1,13 @@
+---
+"@understudy/protocol": minor
+"@understudy/connector": minor
+---
+
+Release protocol 3, remove the cloud-secret command and credential connector,
+and add the `semantic-elements-v1` capability.
+
+Add bounded semantic capture, deterministic find, inspect, continuation,
+same-document deltas, fixed action failures, device-policy, physical-window
+inventory, suspended-session adoption, attended-idle, and extension-local
+payment-card command contracts. Card submission returns only fixed not-started
+or outcome-unknown results.

.gitattributes

@@ -0,0 +1 @@
+apps/backend/worker-configuration.d.ts -whitespace

.github/workflows/deploy.yml

@@ -0,0 +1,111 @@
+name: Deploy
+
+on:
+  push:
+    branches: [master, dev]
+
+concurrency:
+  group: deploy-${{ github.ref_name }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: ${{ github.ref_name == 'dev' && 'staging' || 'production' }}
+    env:
+      PRODUCTION_AUTODEPLOY_ENABLED: ${{ vars.PRODUCTION_AUTODEPLOY_ENABLED }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v6
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install (frozen lockfile)
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm --filter "./packages/*" build
+
+      - name: Typecheck
+        run: pnpm -r typecheck
+
+      - name: Test
+        run: pnpm -r test
+
+      - name: Build
+        run: pnpm -r build
+
+      - name: Check generated Worker types
+        run: pnpm --filter @understudy/backend exec wrangler types --check
+
+      - name: Build and verify staging extension
+        if: github.ref_name == 'dev'
+        run: |
+          pnpm --filter @understudy/extension build:staging
+          pnpm --filter @understudy/extension verify:staging-build
+
+      - name: Dry-run staging Worker
+        if: github.ref_name == 'dev'
+        run: pnpm --filter @understudy/backend exec wrangler deploy --dry-run --env staging --outdir "$RUNNER_TEMP/understudy-staging-worker"
+
+      - name: Deploy staging
+        if: github.ref_name == 'dev'
+        run: pnpm --filter @understudy/backend deploy:staging:ci "$RUNNER_TEMP/staging-deployment.json"
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+
+      - name: Upload staging deployment evidence
+        if: always() && github.ref_name == 'dev'
+        uses: actions/upload-artifact@v4
+        with:
+          name: staging-deployment-${{ github.sha }}
+          path: ${{ runner.temp }}/staging-deployment.json
+          if-no-files-found: error
+
+      - name: Build and verify published extension
+        if: github.ref_name == 'master'
+        run: |
+          pnpm --filter @understudy/extension build:store
+          pnpm --filter @understudy/extension zip:store
+          pnpm --filter @understudy/extension verify:store-release
+          pnpm --filter @understudy/backend verify:production-compatibility
+
+      - name: Dry-run production Worker
+        if: github.ref_name == 'master'
+        run: pnpm --filter @understudy/backend exec wrangler deploy --dry-run --env "" --outdir "$RUNNER_TEMP/understudy-production-worker"
+
+      - name: Deploy production
+        if: github.ref_name == 'master' && vars.PRODUCTION_AUTODEPLOY_ENABLED == 'true'
+        run: pnpm --filter @understudy/backend deploy:production:auto "$RUNNER_TEMP/production-deployment.json"
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+
+      - name: Report disabled production deployment
+        if: github.ref_name == 'master' && vars.PRODUCTION_AUTODEPLOY_ENABLED != 'true'
+        run: echo "Production deployment verified but disabled until the manual protocol-3 cutover completes."
+
+      - name: Upload production store artifact
+        if: github.ref_name == 'master'
+        uses: actions/upload-artifact@v4
+        with:
+          name: production-store-${{ github.sha }}
+          path: apps/extension/.output/understudyextension-*-chrome-store.zip
+          if-no-files-found: error
+
+      - name: Upload production deployment evidence
+        if: always() && github.ref_name == 'master' && vars.PRODUCTION_AUTODEPLOY_ENABLED == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: production-deployment-${{ github.sha }}
+          path: ${{ runner.temp }}/production-deployment.json
+          if-no-files-found: error